update gdpr notice

gdpr_notice.html

@@ -57,6 +57,25 @@
         It collects the requesting party’s IP address and user agent from the
         HTTP request, but does not store them.
       </p>
+<h2 id="analytics">Web analytics (Plausible)</h2>
+<p>
+  This site uses <a href="https://plausible.io">Plausible Analytics</a>. Plausible works without cookies
+  and without cross-site tracking. No personal data is stored.
+</p>
+<ul>
+  <li><strong>Per pageview captured:</strong> page URL (without query params except common campaign tags),
+      referrer, and derived browser/OS/device type; city-level location is inferred from the IP.</li>
+  <li><strong>No raw identifiers stored:</strong> Plausible does not store IP addresses or full user-agents.
+      For daily unique counts it uses a hash of a rotating salt + domain + IP + UA; the salt is deleted
+      every 24 hours.</li>
+  <li><strong>Legal basis:</strong> Art. 6(1)(f) GDPR (legitimate interest) in lightweight, privacy-preserving
+      reach measurement and site improvement.</li>
+  <li><strong>Processor & hosting:</strong> Plausible Insights OÜ (Estonia, EU). Data are processed and stored
+      in the EU on servers in Germany (Hetzner). No transfers outside the EU.</li>
+  <li><strong>Retention:</strong> Only aggregated statistics are kept for as long as the site is active.
+      You can contact me if you have questions regarding this processing.</li>
+  <li><strong>Public stats (optional):</strong> If enabled, a public dashboard link will be added here.</li>
+</ul>
       <p>For any questions or concerns contact:<br/>
       Veit Heller<br/>
       Moltkestr. 5<br/>